Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
93 results · Showing 81–93
Court case III CZP 78/19
The parties were involved in social initiatives aimed at supporting or questioning the need for certain investments in the vicinity of the housing estate where they live. The defendants accused the claimant that, as a result of her interventions in the housing estate, the city carried out no investments. The defendants publicly criticised the claimant's attitude and they also expressed their opinions in social media. The applicant claimed that the defendants had thereby infringed her personal rights. The Regional Court held that there was no infringement, as the defendants exercised their right to freedom of expression. In the Regional Court's opinion the defendants cannot be held responsible for the form of statements made by other people, including Internet users. The claimant has appealed against the judgment. The claimant complained that the court omitted her request for evidence to oblige the domain registrar and the Internet access service provider to disclose the names and addresses of subscribers to the service using pseudonyms (nicknames), who published entries about the claimant on an Internet forum. The Court of Appeal identified the subscriber of the domain and obtained from him information about e-mail addresses to the accounts with logins indicated by the claimant and lists of posts written from those addresses. Next, it called the Internet provider for the established IP addresses to indicate the subscribers of the Internet access service. The Internet provider refused to provide information, citing telecommunication secrecy. Additionally, it indicated that the deadline within which it is obliged to store, among others, the data requested by the Court, has already passed. The Court of Appeal has addressed the Supreme Court with a legal issue. Is an entity providing Internet access services, i.e. an entity bound by telecommunication secrecy, entitled to refuse to provide personal data of the subscriber of this service in a case of infringement of personal rights, if it is the content presented via the Internet that may constitute the basis for this infringement and in this case is the basis for providing this data at the request of a civil court? The Supreme Court held that a court is entitled to demand from an entity bound by telecommunications secrecy information that allows to verify the claimant's claim that an act infringing her personal rights was committed by the defendant in the case.
Association des agences de communication
L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ 4th of July 2019 CNIL deliberation] on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'? The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given ([https://edpb.europa.eu/our-work-tools/our-documents/otros/statement-edpb-revision-eprivacy-regulation-and-its-impact_en 25 May 2018, on ePrivacy]): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regulation of April 27, 2016, the CNIL has exceeded what it can legally do, within the framework of an instrument of soft law, enacted on the basis of 2° of I of article 8 of the law of January 6, 1978 cited in point 3. It follows that the contested deliberation is, to this extent, tainted with illegality" (CE). All the remaining points of the CNIL guidelines were validated.
Court case N° 434684
Several private companies challenges the guidelines of the CNIL on cookies on several grounds, including excess of powers. The Council of State validated most of the interpretations or recommendations provided in the guidelines: - Individuals should be able to decline to give consent as easily as to give consent; Individuals must be able to withdraw their consent as easily as they gave it; - User consent should be given for each purpose, which implies specific information; - Individuals must be informed of the identity of the controllers depositing cookies; the list containing the identity of the controllers must be made available to them at the time consent is obtained and must be regularly updated; - Data controllers must be able to demonstrate that they have obtained valid consent to the CNIL. However, in its decision of 19 June 2020, the Council of State suppressed a paragraph in which the CNIL considered that the Internet user should not suffer major inconvenience in the event of the absence or withdrawal of consent. The CNIL considered in particular that access to a website could never be subject to the acceptance of cookies ("cookie walls"). The Council of State considered that by deducting this general prohibition from the GDPR, the CNIL had gone beyond what is legally possible with guidelines, which are an instrument of "soft law".
Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e. V.
See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/). The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {| class="wikitable" !English translation !German original |- |‘I agree to the web analytics service Remintrex being used for me. This has the consequence that, following registration for the lottery, the lottery organiser, [Planet49], sets cookies, which enables Planet49 to evaluate my surfing and use behaviour on websites of advertising partners and thus enables advertising by Remintrex that is based on my interests. I can delete the cookies at any time. You can read more about this here.’ |"Ich bin einverstanden, dass der Webanalysedienst Remintrex bei mir eingesetzt wird. Das hat zur Folge, dass der Gewinnspielveranstalter, [Planet49], nach Registrierung für das Gewinnspiel Cookies setzt, welches Planet49 eine Auswertung meines Surf- und Nutzungsverhaltens auf Websites von Werbepartnern und damit interessengerichtete Werbung durch Remintrex ermöglicht. Die Cookies kann ich jederzeit wieder löschen. Lesen Sie Näheres hier." |} In the explanation linked to the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID) associated with the registration data of the user who entered his/her name and address in the web form provided. If the user with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded, as well as which product the user is interested in and whether a contract is concluded. Following the CJEU's reasoning in its preliminary ruling, the BGH dismissed the defendants' appeal and, on the plaintiff's appeal, overturned the appellate judgment regarding cookie consent and restored the first instance conviction of the defendant: *The declaration of consent by the preselected tick box does not constitute an "informed indication of the data subject's wishes" within the meaning of Article 2(h) Directive 95/46/EC or an "informed and unambiguous indication of the data subject's wishes" within the meaning of Article 2(h) GDPR. Therefore there is no legally valid consent for the data processing. *The plaintiff is entitled to injunctive relief against the storage of cookies on his device under § 1 UKlaG in connection with § 307 BGB because the request for consent by a preselected tick box constitutes an "unreasonable disadvantage to the user". *The request for consent by a preselected tick box further violates § 15 TMG. An interpretation of § 15 TMG in light of Article 5(3) Directive 2002/58/EC leads to the conclusion that there is no effective consent within the meaning of these provision if the storage of cookies is permitted by a present checkbox which the user must uncheck to refuse consent. *Pursuant to Article 94 and 95 GDPR the above said fully applies also after 25.05.2018.
The State of the Netherlands
The plaintiff asked to the State to grant him access to procedural files in which he was involved against the State of the Netherlands concerning forgeries offence. The applicant claimed that the procedural files contained his personal data and evidences which could help him to prove his innocence in the aforementioned case and all the cases in which he would have been involved as party against the State. The State refused to grant him the access. The Court clarified the interplay between the right to inspection under the ePrivacy Directive and the right to access under the GDPR. First, the Court examines the basis of the applicant's request pursuant to Article 12 of the Code of Civil Procedure which requires to state fully and truthfully the relevant facts, and to submit all the document relevant to the application. In this regard, the Court considered that the applicant did not comply with this obligation. Indeed, the Court pointed out there is no docuiment showing that the applicant submitted an inspection request of the procedural files at stake. Then, the Court clarified that both the ePrivacy Directive and the GDPR apply. It considered that the right of inspection of document including personal data is not absolute. However, it stated that the access right and the right of inspection have to be understood as a right to a complete overview of all personal data, in a form that enables the data subject to inspect his or her data and to check that they are correct and have been processed lawfully. Regarding the format, the Court recalled that the data subject cannot expect to be provided with the original document and that the material form depends on the concrete circumstances. Finally, the Court considered that in any cae, the applicant's purpose was not to verify the accuracy and lawfulness of the personal data processed but to use them to prove his innocence in the case he was involved against the State and in any proceedings to be brought against the State. Thus, the court ruled that the applicant could not invoke the right to inspection because his claim did not concern the protection of his personal data and therefore, there was an abuse of rights. As a consequence, the court considered the applicant's claim as inadmissible.
VKI
The Austrian consumer organization ("Verein für Konsumenteninformation", VKI) has sued the provider of encrypted digital terristrial TV in Austria ("Simply TV") under the Austrian implementation of the Unfair Terms Directive 93/13/EEC (§ 6 Konsumentenschutzgesetz - KSchG) because it allegedly used 29 illegal clauses in its Terms of Service. Two clauses (18 and 19) concern data processing. The other parts of the judgment are irrelevant for the purpose of this page. = "The personal data provided by the subscriber as well as data on the type and frequency of his use of the services provided by Simply TV shall be collected, stored, used by Simply TV - insofar as this is necessary for the processing of subscriptions, for the provision of customer services as well as for the invoicing of remuneration - and transmitted to commissioned companies for the purposes of order data processing pursuant to § 11 Data Protection Act 2000." = "Simply TV may send electronic messages (in particular e-mail, SMS) to the subscriber for the purpose of informing him of offers from Simply TV in the pay-TV sector which are similar to the packages and/or channels already subscribed to by the subscriber. Simply TV will only transmit such messages if the subscriber has provided Simply TV with the relevant contact details (in particular e-mail address, telephone number) as part of the subscription. The subscriber may object to the transmission of such messages at any time in writing (post, fax, e-mail: infoservice@s*****.at). The subscriber will be informed of his right of revocation at each transmission of such messages." = VKI claimed that the clause is intransparent, as the controller does not inform about (1) the concrete companies data is shared with, (2) the the fact that the data subject can withdraw his consent at any time and because (3) the data subject may get the false impression that the clause would generally allow to use personal data as describted in the clause during the entired contractual relationship. The controller claimed that there is no duty to name each recipient and that the processing of data was necessary to fullfil thee contract and for the best possible customer service. = VKI claimed that this clause violates the implementation of Article 13(2) of ePrivacy Directive 2002/58/EG in § 107 of the Austrian Telecommunications Act (TKG), as it does not allow to opt-out from direct marketing communications. The controller claimed that the clause explicitly refers to the right to object. Both clauses were found to be invalid. = The Court joined the view of VKI that the limitation on processing that is necessary for certain purposes (if read in the grammatical meaning) is only limited to the controller, while there is no purpose limitation for sharing data with third parties. The clause would thereby allow to share any data for any purpose with any third party. This was frond to be unfair within the meaning of the Unfair Terms Directive 93/13/EEA. The court further held that the clause "for purposes of processing by the processor under § 11 Data Protection Act 2000" is ins transparent and not understandable to the average consumer. There was no need to reassess the issue under GDPR, as this clause was already unlawful under the Austrian implementation of Directive 95/46. = The Court joined the view of VKI and focused on the fact that objection to direct marketing messages under Article 13(2) of the ePrivacy Directive has to be possible "without any difficulty" ("problemlos"). In the case of text messages (SMS) a consumer has to switch to another form of communication, which is not "without any difficulty", especially when consumers are away from home. It agreed with the lower Courts that it is ins transparent that a possibility to object is not already presented at the time of signing the contract.
La Quadrature du Net
In July 2018 the CNIL adopted a decision clarifying the new rules on consent for targeted advertisement under GDPR. It initiated a consultation process for the first quarter of 2020 to define the practical arrangements for obtaining consent. It determined a six-month adaptation period. Two associations requested to annul the decision of CNIL on grounds of excess of power and to instruct it to publish both on its website and on the pages of its press releases of 28 June and 18 July, a reference to the decision of the Conseil d'Etat which should indicate that "continued navigation" does not constitute a valid means of expressing consent for cookies and online tracking devices, while every day of delay would imply a penalty of 500 euros. The Council has to assess whether the CNIL had the power to initiate such a process. The Council found that the CNIL is an independent administrative authority with wide discretion in the exercise of its missions. In this sense, the CNIL can initiate such an action plan in order to achieve more effective compliance with the data protection law. The Council ruled that the six-month period of tolerance which the CNIL provided the stakeholders in order to fully comply with the rules is legal. Finally, the CNIL’s decision does not prevent the Commission from carrying out controls during the mentioned period and imposing sanctions for serious breaches of the new data protection framework.
Google Inc.
The case focused on contractual terms and privacy policy issues related to Google+, not on cookie consent or tracking violations.
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
The company offered educational services through a fan page hosted by Facebook. As administrators, they obtained statistical information on visitors to the fan page via Facebook Insights offered by Facebook free of charge under non-negotiable conditions of use. The information was obtained using cookies, each containing a unique user code, stored by Facebook in the devices of visitors and were active for two years. The unique code could be matched with users registered on Facebook and their personal data was collected when the fan page was opened. Neither the company nor Facebook notified users/visitors of the fan page of the storing of cookies or processing of their personal data. The Independent Data Protection Centre Germany, (ULD) made a decision on 3rd November 2011 against the company ordering them to deactivate the fan page within the prescribed period or pay a penalty fine on grounds that: 1. Neither Facebook nor the company notified the users that Facebook collected Personal data of the users; 2. Facebook processed personal data of the users. The company brought a dispute against that decision arguing that it was not responsible for the processing of personal data under the data protection law. This dispute went back and forth from the Administrative Court to the Federal Court who referred the matter to the CJEU seeking clarifications on whether an administrator of a fan page hosted by a social network is a controller within the definition under Article 2 (d)of Directive 95/46. The CJEU held that the mere fact of using a social network doesn’t make the user a controller responsible for processing personal data. However, an administrator who creates a fan page, consents to the use policy, cookies policy, defines the objectives and promotes its activities has an influence on the processing of personal data for the purpose of producing a statistical report, by Facebook, on the fan page, whether anonymized or not. Thus, the administrator is a joint controller with Facebook under Article 2(d) Directive 95/46. It also held that, as a joint controller with Facebook, the administrator’s responsibility is not equal to that of Facebook because they may be involved at different stages of that processing of personal data and to different degrees.
Tele2 Sverige AB
The case focused on data retention laws and their compatibility with EU laws, not cookies or consent mechanisms.
Institut professionnel des agents immobiliers (Belgian Institute of Estate Agents)
The Belgian Professional Institute of Real Estate Agents (IPI) had used private detectives to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the company’s agents had not been informed that their personal data would be processed by third parties in accordance with [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 11(1) of the Data Protection Directive 95/46]. IPI argued that the use of private detectives fell within the exception under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46], which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions. Belgian law had specified exceptions for journalistic purposes, artistic or literary expression, public authorities exercising judicial police duties, police services and the European Centre for Missing and Sexually Abused Children. The Belgian Constitutional Court considered that the Belgian law did not strictly transpose exceptions comparable to [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13 of Directive 95/46/EC]. It referred three questions to the ECJ for clarification on the obligations for Member States to implement Article 13 in national law: # Does [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46] leave Member States free to choose whether or not to provide for an exception to the immediate obligation to inform under Article 11(1) to protect others’ rights and freedoms? # Do professional activities of private detectives (governed by national law) come within an exception referred to in [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) and (g) of Directive 95/46]? # If they do not, is [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) and (g) of Directive 95/46] compatible with Article 6(3) TEU – specifically, with the principle of equality and non-discrimination? With regard to the first question, the Court ruled that Member States have the option, but not an obligation, to transpose the list of exceptions provided under Article 13 of the Data Protection Directive 95/46/EC. Article 13 permits Member States to adopt exemptions allowing the collection and processing of personal data without notifying the data subject in seven circumstances: * To safeguard national security. * For defence. * For public security. * For the prevention, investigation, detection and prosecution of criminal offenses or breaches of ethics for regulated professions. * For an important economic or financial interests of a Member State. * For monitoring, inspection or regulatory functions. * For the protection of the data subject or the rights and freedoms of others. The CJEU based its interpretation on the emphasis on a high level of protection found in recitals 3, 8 and 10 of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Directive 95/46]. In provisions such as these, [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Directive 95/46]'s aim of harmonisation must be balanced against the applicability of the Directive's general language in specific situations and the need to afford Member States some flexibility in this regard. With regard to the second question, the CJEU considered that the activity of a private investigator on behalf of a regulated body – in this case, the IPI – falls within the scope of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46]. Thus, if a Member State has chosen to implement an exception pursuant to [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46], the professional body concerned and the private detectives acting on its behalf may rely on it. Accordingly, they need not inform the data subject pursuant to [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 10 and 11 of Directive 95/46].
SABAM
SABAM is a management company which represents authors, composers and publishers of musical works. Netlog ran an online social networking platform. On their Netlog profile, users could keep a diary, indicate their hobbies and interests, show who their friends are, display personal photos or publish video clips. However, SABAM claimed that the social network offered all users the opportunity to make use, by means of their profile, of the musical and audio-visual works in SABAM’s repertoire, making those works available to the public in such a way that other users of that network could access them without SABAM’s consent and without Netlog paying it any fee. SABAM first unsuccessfully tried to negotiate a licensing agreement with the social network, then gave it a notice that it should give an undertaking to cease and desist from making available to the public musical and audio-visual works from SABAM’s repertoire without the necessary authorisation - also without results. Given the lack of action taken by the social network, SABAM had it summoned before the Brussels Court of First Instance (rechtbank van eerste aanleg te Brussel) in injunction proceedings under Article 87(1) of the Law of 30 June 1994 on copyright and related rights. It requested that Netlog be ordered immediately to cease unlawfully making available musical or audio-visual works from SABAM’s repertoire and to pay a penalty of €1000 for each day of delay in complying with that order. The social network submitted that granting SABAM’s injunction would (1) effectively impose on Netlog a general obligation to monitor, which was prohibited by Article 15(1) of Directive 2000/31 and (2) introduce, at Netlog's own cost and for an unlimited period, a system for filtering most of the information which is stored on its servers in order to identify and block electronic files containing musical, cinematographic or audio-visual work in respect of which SABAM claims to hold rights. The rechtbank decided to stay the injunction proceedings and refer the following question to the CJEU:"Do Directives 2001/29 and 2004/48, in conjunction with Directives 95/46, 2000/31 and 2002/58, construed in particular in the light of Articles 8 and 10 of the European Convention on the Protection of Human Rights and Fundamental Freedoms [signed in Rome on 4 November 1950], permit Member States to authorise a national court, before which substantive proceedings have been brought and on the basis merely of a statutory provision stating that “[the national courts] may also issue an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right”, to order a hosting service provider to introduce, for all its customers, in abstracto and as a preventive measure, at its own cost and for an unlimited period, a system for filtering most of the information which is stored on its servers in order to identify on its servers electronic files containing musical, cinematographic or audio-visual work in respect of which SABAM claims to hold rights, and subsequently to block the exchange of such files?" The CJEU first essentially restated its judgment in Scarlet Extended, finding it had to determine whether the injunction would require Netlog to carry out general monitoring of all the information that it stores. It then considered the requirements that stem from the protection of the applicable fundamental rights, namely SABAM's copyright, referring to the judgment in Promusicae to highlight that rights linked to intellectual property must be balanced against the protection of other fundamental rights. It then carried out this balancing exercise in the context of the case at hand, finding that because the injunction would result in a serious infringement of Netlog's freedom to conduct its business since it would require the company to install a complicated, costly, permanent computer system at its own expense, which would also be contrary to the conditions laid down in Article 3(1) of Directive 2004/48, which requires that measures to ensure the respect of intellectual-property rights should not be unnecessarily complicated or costly. To come to this conclusion, it took into account that the contested filtering system would (1) involve monitoring all or most of the information stored by the hosting service provider concerned, (2) with no limitation in time, (3) be directed at all future infringements and (4) be intended to protect not only existing works, but also works that have not yet been created at the time when the system is introduced. Moreover, it held "the effects of that injunction would not be limited to the hosting service provider, as the contested filtering system may also infringe the fundamental rights of that hosting service provider’s service users, namely their right to protection of their personal data and their freedom to receive or impart information, which are rights safeguarded by Articles 8 and 11 of the Charter respectively." As a result, the CJEU held that: "Directives: * 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce); * 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society; and * 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights, read together and construed in the light of the requirements stemming from the protection of the applicable fundamental rights, must be interpreted as precluding a national court from issuing an injunction against a hosting service provider which requires it to install a system for filtering: * information which is stored on its servers by its service users; * which applies indiscriminately to all of those users; * as a preventative measure; * exclusively at its expense; and * for an unlimited period, which is capable of identifying electronic files containing musical, cinematographic or audio-visual work in respect of which the applicant for the injunction claims to hold intellectual property rights, with a view to preventing those works from being made available to the public in breach of copyright."
Deutsche Telekom AG
Deutsche Telekom, a telecommunications network operator in Germany, publishes directories containing data related to its own customers and that of subscribers of approximately 100 other undertakings in accordance with paragraphs 47(1), 104 and 105 of the Telekommunikationsgesetz (German Law on Telecommunications) (‘TKG’). GoYellow and Telex AG operate an internet and telephone directory enquiry service through the use of available data provided to them by Deutsche Telekom for remuneration. However, the aforementioned companies came to a disagreement as to the scope of the data Deutsche Telekom has to provide to GoYellow and Telex AG. The matter was brought before the Bundesnetzagentur. On 11 September 2006, the Court ordered Deutsche Telekom to grant access to GoYellow and Telex AG to both data relating to Deutsche Telekom’s own subscribers and external data (i.e. data related to the subscribers of third-party telephone service providers), even when subscribers wished the respective data to be published solely by Deutsche Telekom. Deutsche Telekom challenged this decision before the Verwaltungsgericht Köln (Administrative Court, Cologne). On 14 February 2008, the Court dismissed the action. Deutsche Telekom appealed before the Bundesverwaltungsgericht (Federal Administrative Court) on the grounds that an obligation to make such external data available infringes Article 25(2) Universal Service Directive 2002/22/EC and Article 12 ePrivacy Directive 2002/58/EC—the matter was referred to the CJEU for a preliminary ruling. The Court firstly determined that Article 25 Universal Service Directive 2002/22/EC does not provide for full harmonization and is aimed at guaranteeing that at least one extensive directory is made available to end-users. Therefore, a minimum requirement is outlined under this article and Member States can consequently impose more stringent provisions. The Court thus held that Article 25(2) Universal Service Directive 2002/22/EC does not preclude national legislation from imposing undertakings assigning telephone numbers to end-users to forward subscriber data relating to their subscribers and subscribers of other undertakings to directory-enquiry services and directory providers. The Court then proceeded to assess the matter in relation to Article 12 ePrivacy Directive 2002/58/EC. It firstly acknowledged that this matter is relevant to the protection of personal data, as enshrined in Article 8(1) CFR. Article 12(2) ePrivacy Directive 2002/58/EC prescribed that subscribers were free to decide whether their personal data was to be included in a public directory, and if that were the case, which personal data too. This right is, however, exclusively related to the purpose for the publication of such data in a public directory, as opposed to the identity of any specific directory provider. Thus, there was no requirement for renewed consent. Moreover, Recital 39 Directive reaffirmed that the passing of subscriber’s personal data to third parties was subject to the (only) condition that such data may not be used for purposes beyond those for which they were collected. In addition, the Directive outlined instances in which additional consent was required, which implies that in all other situations, no consent was needed unless specified. Thus, the Court found that Article 12 ePrivacy Directive 2002/58/EC must be interpreted as allowing Member States to require publishers of directories and suppliers of directory enquiry services to forward personal data to third-party directory publishers without specific consent from the subscribers.